Root User Exploit in OnePlus 7 Pro Fingerprint Sensor Functionality
CVE-2020-7958

6MEDIUM

Key Information:

Vendor

Oneplus

Status
Oneplus 7 Pro Firmware
Vendor
CVE Published:
14 April 2020

What is CVE-2020-7958?

A vulnerability in the OnePlus 7 Pro prior to version 10.0.3.GM21BA allows a privileged root user to exploit leftover debug code in the fingerprint authentication system. This weakness enables attackers to issue additional commands to the Trusted Application (TA) beyond its intended function, resulting in the disclosure of raw fingerprint images. As a consequence, the Trusted Execution Environment (TEE) fails to safeguard sensitive biometric data, raising significant concerns about user privacy and security.

References

https://www.synopsys.com/blogs/software-security/cve-2020...
x_refsource_MISC

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.